Home Search spyware
Jeg har fået en irriterende spyware der hele tiden laver min startside om til: res://rkgci.dll/index.html#37680Siden der dukker op hedder Home Search og jeg kan ikke komme af med den. Hverken Ad-Aware AVG Antivirus eller Spyboot finder noget mistænkeligt. HiJack this finder den og jeg har prøvet at fjerne alt hvad jeg umiddelbart kunne finde der havde noget med den at gøre. Har også søgt i regestreringsdatabasen hvor jeg fandt to ting der hed noget med Startpage rkgci.dll og Homepage rkgci.dll og har slette dem begge men den bliver ved at dukke op igen. Min seneste HiJackThis log ser således ud:
Logfile of HijackThis v1.97.7
Scan saved at 17:19:16, on 15-07-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~2\GRISOFT\AVG6\avgserv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\d3ar.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~2\GRISOFT\AVG6\avgcc32.exe
C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINNT\system32\hphmon04.exe
C:\Program Files\MSN Apps\Updater\01.02.0000.2693\da\msnappau.exe
C:\PROGRA~1\Logitech\WINGMA~1\Lwpevntm.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\system32\sysec.exe
C:\WINNT\system32\HPHipm11.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINNT\system32\appxy32.exe
C:\WINNT\SYSTEM32\cbfks.exe
C:\WINNT\system32\syscdd2.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\sysec.exe
C:\WINNT\system32\syscdd2.exe
C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
C:\WINNT\SYSTEM32\devot.exe
C:\WINNT\SYSTEM32\cbfks.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Fra C\Programmer\HiJack This\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\rkgci.dll/sp.html#37680
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://rkgci.dll/index.html#37680
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://rkgci.dll/index.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\rkgci.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://rkgci.dll/index.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\rkgci.dll/sp.html#37680
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0D789A5D-3EB8-F8ED-FA6B-6F6FA212008C} - C:\WINNT\system32\d3ca32.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~2\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Lwinst Run Profiler] C:\PROGRA~1\Logitech\WINGMA~1\Lwinst.exe -d -l "C:\PROGRA~1\Logitech\WINGMA~1\Lwpevntm.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINNT\system32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Updater] "C:\Program Files\MSN Apps\Updater\01.02.0000.2693\da\msnappau.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Overnet] C:\Program Files\Overnet\eDonkey2000.exe -t
O4 - HKLM\..\Run: [Microsoft Synchronization Manager] sysec.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [appxy32.exe] C:\WINNT\system32\appxy32.exe
O4 - HKLM\..\Run: [ICQMsn] C:\WINNT\SYSTEM32\cbfks.exe
O4 - HKLM\..\Run: [ICQ] syscdd2.exe
O4 - HKLM\..\RunServices: [Microsoft Synchronization Manager] sysec.exe
O4 - HKLM\..\RunServices: [ICQ] syscdd2.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Window Washer] C:\PROGRAMMER\Webroot\Washer\wwDisp.exe /startup
O4 - HKCU\..\Run: [Microsoft Synchronization Manager] sysec.exe
O4 - HKCU\..\Run: [ICQ] syscdd2.exe
O4 - Startup: H3 The Shadow of Death(TM).lnk = C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - http://194.255.127.250/WOCO/applet
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/089cfbcaf6fcaec36418/netzip/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/12119/CTPID.cab
Hvad gør jeg?
